← All tracked CVEs
Updated 17:00
972 in progress
| CVE | Status | Severity | Summary | Distribution |
|---|---|---|---|---|
| In progress | Low | GHSA-965h-392x-2mh5: Library ignores URI name constraints; restricted certificates accepted; exploit requires misissuance after signature verification. | secure-packages-25.11 | |
| In progress | Low | GHSA-w6xc-g9qj-vp32: safe_traversal Linux-only; macOS/FreeBSD directory traversal lacks fd-relative TOCTOU, vulnerable to symlink races | secure-packages-25.11 | |
| In progress | Low | GHSA-xgp8-3hg3-c2mh: Wildcard DNS names bypass permitted subtree checks in X.509 name constraints | secure-packages-26.05 | |
| In progress | Medium | GHSA-chgr-c6px-7xpp: PyCFunction::new_closure lacks Sync bound, enabling data races under free-threaded or concurrent Python execution | secure-packages-25.11 | |
| In progress | Medium | GHSA-mh29-5h37-fv8m: Prototype pollution in js-yaml parsing via __proto__ on untrusted input (pre-4.1.1/3.14.2) | secure-packages-25.11 | |
| In progress | Low | GHSA-2w8r-9xj7-69j5: uutils mktemp mishandles empty TMPDIR, uses CWD instead of /tmp, risking data exposure | secure-packages-25.11 | |
| In progress | Medium | GHSA-6gx3-4362-rf54: astral-tokio-tar <=0.5.6 silently skips malformed PAX extensions, enabling parser differentials | secure-packages-25.11 | |
| In progress | Medium | GHSA-chgr-c6px-7xpp: PyCFunction::new_closure lacks Sync bound, enabling data races under free-threaded or concurrent Python execution | secure-packages-25.11 | |
| In progress | Medium | GHSA-2frx-2596-x5r6: gitoxide uses SHA-1 without collision detection, enabling collision attacks and breaking Git object integrity | secure-packages-25.11 | |
| In progress | Low | GHSA-w6xc-g9qj-vp32: safe_traversal Linux-only; macOS/FreeBSD directory traversal lacks fd-relative TOCTOU, vulnerable to symlink races | secure-packages-25.11 | |
| In progress | Low | GHSA-965h-392x-2mh5: URI name constraints ignored and accepted; bug reachable post-signature verification; needs misissuance | secure-packages-26.05 | |
| In progress | Medium | GHSA-qj8w-gfj5-8c6v: serialize-javascript DoS: CPU exhaustion when serializing crafted array-like object with huge length | secure-packages-26.05 | |
| In progress | Low | GHSA-8fgc-7cc6-rx7x: Webpack buildHttp allowedUris bypass via userinfo, enabling build-time SSRF and untrusted content inclusion | secure-packages-25.11 | |
| In progress | Medium | RUSTSEC-2026-0067: tar-rs ≤0.4.44 unpack_dir symlink bug allows chmod of directories outside extraction root | secure-packages-26.05 | |
| In progress | Medium | GHSA-4gg8-gxpx-9rph: uv <0.11.15 writes entry point executables outside env, enabling PATH hijack and code execution | secure-packages-25.11 | |
| In progress | Medium | GHSA-434x-w66g-qw3r: Unchecked overflow in BytesMut::reserve corrupts capacity, causing OOB UB in release builds | secure-packages-26.05 | |
| In progress | Low | GHSA-965h-392x-2mh5: URI name constraints ignored and accepted; bug reachable post-signature verification; needs misissuance | secure-packages-26.05 | |
| In progress | Medium | GHSA-3pv8-6f4r-ffg2: tar-rs applies PAX headers to non-file entries, causing desync and extraction mismatches | secure-packages-26.05 | |
| In progress | Low | GHSA-68rp-wp8r-4726: Flask omits Vary: Cookie on session membership checks, risking cached user-specific responses | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-2151: Flask <=3.1.2 lacks Vary: Cookie on certain session access, risking cached sensitive data | secure-packages-26.05 | |
| In progress | Medium | GHSA-6w46-j5rx-g56g: Pytest ≤9.0.2 UNIX predictable /tmp/pytest-of-{user} dirs enable local DoS/privilege escalation | secure-packages-26.05 | |
| In progress | Low | GHSA-r374-rxx8-8654: Insecure SHA-1 allowed in Paramiko rsakey.py through 4.0.0 (pre-a448945) | secure-packages-26.05 | |
| In progress | Low | PYSEC-2026-2858: Paramiko rsakey.py allows weak SHA-1 algorithm through 4.0.0 before a448945 | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-1845: UNIX pytest <=9.0.2 insecure /tmp/pytest-of-{user} temp directory enables local DoS/privilege escalation | secure-packages-26.05 | |
| In progress | Medium | GHSA-6w46-j5rx-g56g: UNIX predictable /tmp/pytest-of-{user} in pytest <=9.0.2 allows DoS or privilege escalation | secure-packages-25.11 | |
| In progress | Medium | PYSEC-2026-1845: pytest ≤9.0.2 on UNIX uses predictable '/tmp/pytest-of-{user}', enabling local DoS/privilege escalation | secure-packages-25.11 | |
| In progress | Medium | GHSA-597g-3phw-6986: virtualenv TOCTOU allows symlink attacks on app_data and lock directories up to 20.36.1 | secure-packages-25.11 | |
| In progress | Medium | GHSA-5239-wwwm-4pmq: Pygments <2.20 AdlLexer ReDoS in lexers/archetype.py; public exploit; local-only | secure-packages-25.11 | |
| In progress | Medium | PYSEC-2026-2009: virtualenv <=20.36.1 TOCTOU enables symlink attacks on app_data and lockfile paths | secure-packages-25.11 | |
| In progress | Low | PYSEC-2026-2858: Paramiko up to 4.0.0: rsakey.py allows insecure SHA-1 (pre a448945) | secure-packages-25.11 | |
| In progress | Medium | PYSEC-2026-2044: Werkzeug safe_join permits Windows device names with extensions/spaces, causing send_from_directory hangs | secure-packages-25.11 | |
| In progress | Medium | GHSA-29vq-49wr-vm6x: Werkzeug safe_join accepts Windows device names in subpaths, causing send_from_directory hang. | secure-packages-25.11 | |
| In progress | Medium | PYSEC-2026-2320: Werkzeug <=3.1.5 safe_join allows Windows device names via segmented paths; send_from_directory hangs | secure-packages-25.11 | |
| In progress | Low | GHSA-68rp-wp8r-4726: Flask omits Vary: Cookie on non-mutating session key checks (e.g., 'in'), risking proxy caching | secure-packages-25.11 | |
| In progress | Medium | PYSEC-2026-2151: Flask <=3.1.2 omits Vary: Cookie on 'in' session checks, enabling sensitive caching | secure-packages-25.11 | |
| In progress | Medium | GHSA-87hc-h4r5-73f7: Werkzeug safe_join allows Windows device names with compound extensions/trailing spaces, causing send_from_directory hang | secure-packages-25.11 | |
| In progress | Low | GHSA-g8m3-5g58-fq7m: Undici misparses Set-Cookie SameSite via substring match, enabling silent policy downgrades since 5.15.0 | secure-packages-25.11 | |
| In progress | Low | GHSA-r374-rxx8-8654: Paramiko <=4.0.0 rsakey.py permits insecure SHA-1 algorithm prior to commit a448945 | secure-packages-25.11 | |
| In progress | Medium | GHSA-vmf3-w455-68vh: node-tar misapplies PAX size to metadata headers, desyncing parse and hiding files | secure-packages-25.11 | |
| In progress | Medium | PYSEC-2026-2987: Pygments <2.20.0 AdlLexer ReDoS from inefficient regex; local, public exploit available | secure-packages-25.11 | |
| In progress | Medium | PYSEC-2026-1845: pytest ≤9.0.2 UNIX uses /tmp/pytest-of-{user} dirs enabling local DoS/privilege escalation | secure-packages-rolling | |
| In progress | Medium | GHSA-6w46-j5rx-g56g: UNIX pytest through 9.0.2 predictable /tmp/pytest-of-{user} dirs allow DoS/privilege escalation | secure-packages-rolling | |
| In progress | Medium | GHSA-j934-xhv5-fg8f: Unanchored RE_WS_END search causes quadratic-time slowdown on long selector whitespace/comments | secure-packages-rolling | |
| In progress | Medium | GHSA-gjv8-xp57-g29c: CSS selector ReDoS in soupsieve: overlapping quantifiers in IDENTIFIER cause quadratic backtracking | secure-packages-rolling | |
| In progress | Medium | GHSA-rw4j-r22c-9gc3: AsyncSSH client/server hangs when peer sets channel maximum packet size 0, blocking event loop | secure-packages-26.05 | |
| In progress | High | GHSA-grgv-6hw6-v9g4: Twisted.names DNS decompression DoS via chained compression pointers; single packet hangs reactor | secure-packages-26.05 | |
| In progress | Medium | GHSA-g6x2-hccm-hh4m: Werkzeug safe_join allows Windows device names with empty ADS, causing send_from_directory hang on NTFS | secure-packages-25.11 | |
| In progress | Medium | GHSA-qx36-8mw2-4r3x: Key vault .sock KMS endpoint causes PyMongo to connect to attacker-chosen Unix socket | secure-packages-rolling | |
| In progress | Medium | GHSA-g6x2-hccm-hh4m: Werkzeug safe_join allows Windows device names with empty ADS, hanging send_from_directory on NTFS | secure-packages-rolling | |
| In progress | Medium | GHSA-8fvv-fgr5-f8ch: GridFS API misinterprets hash IDs as query criteria during read/write, bypassing exact match | secure-packages-rolling |